Daily Security Briefing #189

March 10, 2026 | Read Online

Malicious WordPress compromises, Patch Tuesday vulnerabilities, and AI training data poisoning…

Executive Summary

Cybersecurity threats continue to evolve with malicious actors adapting to disruptions. The recent compromise of legitimate WordPress websites highlights the importance of website security. Meanwhile, Microsoft’s March 2026 Patch Tuesday addresses 77 vulnerabilities, including a zero-day remote EoP SQL vulnerability in SQL Server. Additionally, AI training data poisoning has become a growing concern.

Top Articles

When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation Rapid7 Labs identified and analyzed an ongoing compromise of legitimate WordPress websites, misused by an unidentified threat actor to inject a ClickFix implant impersonating a Cloudflare human verification challenge (CAPTCHA). The lure is designed to infect visitors with a multi-stage malware chain that ultimately steals and exfiltrates credentials and digital wallets from Windows systems. Rapid7 Blog

Patch Tuesday - March 2026 Microsoft is publishing 77 vulnerabilities this March 2026 Patch Tuesday. Microsoft is aware of public disclosure of two of today’s vulnerabilities, but without evidence of exploitation in the wild for any (yet), so there are no Microsoft additions to CISA KEV today. Rapid7 Blog

Global Cyber Attacks Remain Near Record Highs in February 2026 Despite Ransomware Decline Global Attack Volumes Remain Elevated Worldwide In February 2026, global cyber attack activity remained near record levels, confirming that elevated attack volumes are becoming the new normal for organizations worldwide. Check Point Blog

CISA Alerts on Ivanti Endpoint Manager Vulnerability Auth Bypass Exploited in the Wild The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed security vulnerability affecting Ivanti Endpoint Manager (EPM) to its Known Exploited Vulnerabilities (KEV) Catalog, warning that the issue is being actively exploited in the wild. GBHackers

Attackers Use Malformed ZIP Archives to Evade Antivirus and EDR Tools Cybersecurity researchers at the CERT Coordination Center (CERT/CC) have issued a warning regarding a newly disclosed evasion technique tracked as VU#976247. Threat actors are increasingly utilizing malformed ZIP archives to bypass Antivirus (AV) and Endpoint Detection and Response (EDR) scanning engines. GBHackers

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The activity involves the exploitation of recently disclosed security vulnerabilities or weak credentials. The Hacker News

Iranian MOIS Actors & the Cyber Crime Connection Iran-linked actors are increasingly engaging with the cyber crime ecosystem. Their activity suggests a growing reliance on criminal tools, services, and operational models in support of state objectives. Check Point Research

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.